SQL-Injection-attacks

SQL Injection attack is the most common website hacking technique. Most websites use Structured Query Language (SQL) to interact with databases. SQL allows the website to create, retrieve, update, and delete database records. It used for everything from logging a user into the website to storing details of an eCommerce transaction. An SQL injection attack places SQL into a web form in an attempt to get the application to run it. For example, instead of typing plain text into a username or password field, a hacker may type in ‘ OR 1=1. If the application appends this string directly to an SQL command that is designed to check if a user exists in the database, it will always return true. This can allow a hacker to gain access to a restricted section of a website. Other SQL injection attacks can be used to delete data from the database or insert new data. Hackers sometimes use automated tools to perform SQL injections on remote websites. They will scan thousands of websites, testing many types of injection attacks until they are successful. SQL injection attacks can be prevented by correctly filtering user input. Most programming languages have special functions to safely handle user input that is going to be used in an SQL query.

<div class="col-12 col-lg-7"> <div class="post-title"> <h1>SQL (Structured query language) Injection</h1> <div class="post-stats"> <span class="view-count">324.3k views</span> <div class="holder"> <span class="hero-tags"> <a class="" target="_self" href="https://www.imperva.com/learn/application-security/">App Security</a><span>Threats</span> </span> <div class="share-icon-bar"><!-- Facebook --> <div class="fl-fl float-fb transition-active"> <a href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.imperva.com%2Flearn%2Fapplication-security%2Fsql-injection-sqli%2F" target="_blank" event-action="Click" event-label="SQL (Structured query language) Injection" gtm-track=""><i class="fa fa-facebook"></i></a> </div><!-- Twitter --> <div class="fl-fl float-tw transition-active"> <a href="https://twitter.com/share?url=https%3A%2F%2Fwww.imperva.com%2Flearn%2Fapplication-security%2Fsql-injection-sqli%2F&amp;text=SQL (Structured query language) Injection&amp;hashtags=ImpervaResources" target="_blank" event-action="Click" event-label="SQL (Structured query language) Injection" gtm-track=""><i class="fa fa-twitter"></i></a> </div><!-- LinkedIn --> <div class="fl-fl float-li transition-active"> <a href="http://www.linkedin.com/shareArticle?mini=true&amp;url=https%3A%2F%2Fwww.imperva.com%2Flearn%2Fapplication-security%2Fsql-injection-sqli%2F" target="_blank" event-action="Click" event-label="SQL (Structured query language) Injection" gtm-track=""><i class="fa fa-linkedin"></i></a> </div></div> </div> </div> </div> <div class="article-content"> <h2 id="what-is-sql-injection" class="section-active">What is SQL injection</h2> <p>SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. This information may include any number of items, including sensitive company data, user lists or private customer details.</p> <p>The impact SQL injection can have on a business is far-reaching. A successful attack may result in the unauthorized viewing of user lists, the deletion of entire tables and, in certain cases, the <a class="inlinks" href="https://www.imperva.com/learn/application-security/ethical-hacking/">attacker</a> gaining administrative rights to a database, all of which are highly detrimental to a business.</p> <p>When calculating the potential cost of an SQLi, it’s important to consider the loss of customer trust should personal information such as phone numbers, addresses, and credit card details be stolen.</p> <p>While this vector can be used to attack any SQL database, websites are the most frequent targets.</p> <h2 id="what-are-sql-queries" class="">What are SQL queries</h2> <p>SQL is a standardized language used to access and manipulate databases to build customizable data views for each user. SQL queries are used to execute commands, such as data retrieval, updates, and record removal. Different SQL elements implement these tasks, e.g., queries using the SELECT statement to retrieve data, based on user-provided parameters.</p> <p>A typical eStore’s SQL database query may look like the following:</p> <pre>SELECT ItemName, ItemDescription FROM Item WHERE ItemNumber = ItemNumber</pre> <p>From this, the web application builds a string query that is sent to the database as a single SQL statement:</p> <pre>sql_query= " SELECT ItemName, ItemDescription FROM Item WHERE ItemNumber = " &amp; Request.QueryString("ItemID")</pre> <p>A user-provided input&nbsp;<span class="url-example">http://www.estore.com/items/items.asp?itemid=999</span>&nbsp;can then generates the following SQL query:</p> <pre>SELECT ItemName, ItemDescription FROM Item WHERE ItemNumber = 999</pre> <p>As you can gather from the syntax, this query provides the name and description for item number 999.</p> <h2 id="types-of-sql-injections">Types of SQL Injections</h2> <p>SQL injections typically fall under three categories: In-band SQLi (Classic), Inferential SQLi (Blind) and Out-of-band SQLi. You can classify SQL injections types based on the methods they use to access backend data and their damage potential.</p> <h3><strong>In-band SQLi</strong></h3> <p>The attacker uses the same channel of communication to launch their attacks and to gather their results. In-band SQLi’s simplicity and efficiency make it one of the most common types of SQLi attack. There are two sub-variations of this method:</p> <ul> <li><strong>Error-based SQLi</strong>—the attacker performs actions that cause the database to produce error messages. The attacker can potentially use the data provided by these error messages to gather information about the structure of the database.</li> <li><strong>Union-based SQLi</strong>—this technique takes advantage of the UNION SQL operator, which fuses multiple select statements generated by the database to get a single HTTP response. This response may contain data that can be leveraged by the attacker.</li> </ul> <h3><strong>Inferential (Blind) SQLi</strong></h3> <p>The attacker sends data payloads to the server and observes the response and behavior of the server to learn more about its structure. This method is called blind SQLi because the data is not transferred from the website database to the attacker, thus the attacker cannot see information about the attack in-band.</p> <p>Blind SQL injections rely on the response and behavioral patterns of the server so they are typically slower to execute but may be just as harmful. Blind SQL injections can be classified as follows:</p> <ul> <li><strong>Boolean</strong>—that attacker sends a SQL query to the database prompting the application to return a result. The result will vary depending on whether the query is true or false. Based on the result, the information within the HTTP response will modify or stay unchanged. The attacker can then work out if the message generated a true or false result.</li> <li><strong>Time-based</strong>—attacker sends a SQL query to the database, which makes the database wait (for a period in seconds) before it can react. The attacker can see from the time the database takes to respond, whether a query is true or false. Based on the result, an HTTP response will be generated instantly or after a waiting period. The attacker can thus work out if the message they used returned true or false, without relying on data from the database.</li> </ul> <h3><strong>Out-of-band SQLi</strong></h3> <p>The attacker can only carry out this form of attack when certain features are enabled on the database server used by the web application. This form of attack is primarily used as an alternative to the in-band and inferential SQLi techniques.</p> <p>Out-of-band SQLi is performed when the attacker can’t use the same channel to launch the attack and gather information, or when a server is too slow or unstable for these actions to be performed. These techniques count on the capacity of the server to create DNS or HTTP requests to transfer data to an attacker.</p> <h2 id="sql-injection-example">SQL injection example</h2> <p>An attacker wishing to execute SQL injection manipulates a standard SQL query to exploit non-validated input <a class="inlinks" href="https://www.imperva.com/learn/application-security/vulnerability-management/">vulnerabilities</a> in a database. There are many ways that this attack vector can be executed, several of which will be shown here to provide you with a general idea about how SQLI works.</p> <p>For example, the above-mentioned input, which pulls information for a specific product, can be altered to read&nbsp;<span class="url-example">http://www.estore.com/items/items.asp?itemid=999 or 1=1</span>.</p> <p>As a result, the corresponding SQL query looks like this:</p> <pre>SELECT ItemName, ItemDescription FROM Items WHERE ItemNumber = 999 OR 1=1</pre> <p>And since the statement 1 = 1 is always true, the query returns all of the product names and descriptions in the database, even those